Search code examples
regexregex-groupsplunkdata-extraction

Extracting multi values with regex ( Only values, don't need Fieldname )


I'm trying to extract the following 5 data with regex101.

[^=]+\s=\s(?<value_v2c>[^=]+)(?:varbind-delimiter|$)

↓↓↓↓

https://regex101.com/r/z06cgp/1

[1] INTEGER: 3

[2] STRING: "Gray"

[3] STRING: "Red"

[4] STRING: "i-13-130213-E3VM"

[5] STRING: "Virtual machine failover may have occurred_ - Event: vSphere HA restarted a virtual machine (20780030) Summary: vSphere HA restarted virtual Summary: vSphere HA restarted virtual machine i-13-130213-E3VM on host je22v-p01bvs25.shamrock.local in cluster je22v-p01b Date: 11/24/2021 4:01:07 PM VM: i-13-130213-E3VM Host: je22v-p01bvs25.shamrock.local Resource pool: je22v-p01b Data center: jp-east-22v Arguments: eventTypeId = com.vmware.vc.ha.VmRestartedByHAEvent objectId = vm-147534 objectName = i-13-130213-E3VM severity = warning "

But I can't extract the [5] part for the life of me. Can someone please help me?

I also need to use the same regular expression to extract the following data(regex101). This sample does the extraction, but I need to use the same regex above.

↓↓↓↓

https://regex101.com/r/UNEbvi/1

Thanks in advance!!!


Solution

  • The negated character class [^=]+ will not match until varbind-delimiter or the end of the string for the last part, as that character is present in the text.

    You can use a non greedy match with a positive lookahead instead:

    [^=]+\s=\s(?<value_v2c>.*?)(?=varbind-delimiter|$)
    

    Regex demo